GET /index.php?param=: Attempting a cross-site scripting (XSS) attack.

It attempted to perform Uncontrolled Format String attacks on the Apache server.

This IP belongs to United Continental Holdings.

GET /.git/config: Trying to access source code or repository configuration information.

The malicious IP was found trying to exploit the IMAP 'unselect' vulnerability.

Repeated attempts to access the server using old or outdated software versions, which might have known vulnerabilities.

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php: request for a file often associated with an outdated version of Composer and phpunit used in a remote code execution attack.

The IP launched timing attacks, trying to understand our server timings for potential future exploits.

This IP belongs to World Fuel Services.

This IP belongs to Citigroup.

This IP belongs to Nationwide.

Unusual Query String Patterns: Repeated HTTP requests with minor alterations to the query string data, signifying an attacker mapping out how different inputs affect the response.

Multiple attempts to access the server using credentials of inactive or seldom-used accounts.

Repeated HTTP requests with error codes, indicating failed attempts to access restricted areas.

It attempted to use the Postfix server to relay phishing emails to other servers.

Our technical team unearthed the IP's involvement in distributing malicious mobile spyware.

The IP attempted to use the Mail server to relay emails with malicious links to other servers.

High network traffic at unusual times, suggesting an automated process is running.

The IP attempted to delete files from the FTP server.

It attempted to exploit known vulnerabilities in the Mail protocol.

This IP belongs to Intel.

Multiple requests with identical Accept-Encoding headers.

It attempted to perform a phishing attack using the POP3 server.

GET /cfide/administrator: Looking for misconfigured Adobe ColdFusion admin panel.

Unusual patterns in session IDs.